How can I find writable Windows services using PowerShell?

You can use PowerShell with WMI to list all services and their executable paths: `Get-WmiObject win32_service | select Name,PathName`. Then extract each path, check folder permissions with `Get-Acl`, and filter out owners like `NT AUTHORITY\SYSTEM`, `NT SERVICE\TrustedInstaller`, or `BUILTIN\Administrators`. A full automated script is provided in the article Use powershell to find a writable windows service.